patchwork-rb 0.1.7 → 0.1.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 966c3f0f6ac7395698a0f34d355813f86af4f8e685623197c0018b9c70ad53f7
-  data.tar.gz: 7919e2bd0ea6b8be6868f8bdc8972baaa727b9722d6be784458df7b702af1c96
+  metadata.gz: a83f39124088d921584da26ad346e4d61161b843f0495771ab0342c14cb88879
+  data.tar.gz: 3dde8e91a81d42d90c449d5789720cce885712ce7452dcd025d6e082e3e9d2a4
 SHA512:
-  metadata.gz: b84168c956d15378261d722a48d3de3a32df59b6176d10b3ed5d6789db6bbaf024b8bafbc89579edf2a497c5e1fbf238c7d9d894eebd22dffcbece6d500e9aa3
-  data.tar.gz: 5507f4f8baaa7c454669a3ce71b611313d78d58ba369b28969bfeada6488332122b38606e32672e12db0c0ec98baa96d12af1ca6daa728d1db8e7b55f238ee1d
+  metadata.gz: e9071f60b2b687cd47ae7526a8ef92b603ccc7df804d1051275efe7a74ea2f2cc4eae601560be959346ef9114977794248b4bba4024a49f52c0e8e8358868e85
+  data.tar.gz: 687340d10a3cd2e15857bdfa8f712e72e9d9d9ce94bf4ff32966121bebca0a441bcb861791846a6f65a38a7ad095f51eb0f010551011f5318f3ad5ca7215e11d

data/README.md

@@ -126,7 +126,8 @@ class PatchworkController < ApplicationController
     render json: Patchwork::Mint.relay(
       body: request.raw_post,
       signature: request.headers["Patchwork-Signature"],
-      path: request.path
+      path: request.path,
+      query: request.query_string
     ), status: :created
   rescue Patchwork::InvalidSignature
     head :unauthorized
@@ -140,7 +141,7 @@ Build the subject from server state, never from request params. On the direct br
 
 Set `connection_id` in your configuration when the agent has unpinned customer tools, and every minted token carries it — the direct branch, the relay branch, and the gateway. `issue` also takes `connection_id:` for a one-off. It is a connection UUID, not a name.
 
-`Mint.relay` mints for exactly the subject Patchwork sent, never a default, and verifies the signature before it reads the subject at all. `jwks` publishes the public half of your signing key, so Patchwork can verify what you minted. Set its URL on your workspace.
+`Mint.relay` mints for exactly the subject Patchwork sent, never a default, and verifies the signature before it reads the subject at all. Pass `query:` — Patchwork signs the query it sends, so a `mint_url` that carries one needs it here or the `v2` value is checked against the bare path. `labels:` works here too, if you want to require `v2`. `jwks` publishes the public half of your signing key, so Patchwork can verify what you minted. Set its URL on your workspace.
 
 If you mount the gateway in section 4, `mint_path: "/patchwork/mint"` makes it answer the relay call before your controller sees it, and you can drop `relay_mint`. Your frontend's unsigned request still reaches `mint`.
 
@@ -248,7 +249,7 @@ use Patchwork::Gateway,
   labels: [ Patchwork::Signature::V2 ]
 ```
 
-Requiring `v2` refuses any signature that does not cover the query. Patchwork sends `v2` on every tool call, the relay mint, the connection probe and webhook deliveries, so this is safe to turn on today. It will fail against a platform that has not started sending `v2`, which is why it is not the default.
+Requiring `v2` refuses any signature that does not cover the query. Patchwork sends `v2` on every signed call — tool calls, a patch dry run, the relay mint, the connection probe and webhook deliveries — so this is safe to turn on today. It will fail against a platform that has not started sending `v2`, which is why it is not the default.
 
 Or give any tool whose arguments matter — ids, amounts, anything that writes — a `POST` binding, where the arguments travel in the signed body.
 

data/lib/patchwork/mint.rb

@@ -16,11 +16,19 @@ module Patchwork
     # Verifies the presenter signature, then mints for exactly the subject in
     # the body — never a default, never a widened one. Raises InvalidSignature,
     # StaleSignature or BadRequest.
+    # `query:` is the raw query string the request arrived with. Patchwork signs
+    # the query it sends, so a mint_url that carries one needs it here or the
+    # v2 value is checked against the bare path. Pass it whenever you have it;
+    # the gateway does this for you.
     def self.relay(body:, signature:, path:, secrets: Patchwork.config.request_secrets,
-                   connection_id: Patchwork.config.connection_id)
+                   connection_id: Patchwork.config.connection_id,
+                   query: nil, labels: Signature::LABELS)
       raise BadRequest, "mint body too large" if body.to_s.bytesize > MAX_BODY_BYTES
 
-      Signature.verify!(secrets: secrets, header: signature, method: "POST", path: path, body: body)
+      Signature.verify!(
+        secrets: secrets, header: signature, method: "POST", path: path,
+        query: query, body: body, labels: labels
+      )
       token = SessionToken.issue(subject: relay_subject(body), connection_id: connection_id)
       { token: token, expires_in: Patchwork.config.token_ttl }
     end

data/lib/patchwork/version.rb

@@ -1,3 +1,3 @@
 module Patchwork
-  VERSION = "0.1.7".freeze
+  VERSION = "0.1.8".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: patchwork-rb
 version: !ruby/object:Gem::Version
-  version: 0.1.7
+  version: 0.1.8
 platform: ruby
 authors:
 - Chromablue Labs